EP3963291A1

EP3963291A1 - Sensor array for monitoring a technical system, and method for operating a sensor array

Info

Publication number: EP3963291A1
Application number: EP20732744.6A
Authority: EP
Inventors: Bernhard Andreas Stingl; Fabian Wennekamp
Original assignee: Siemens Mobility GmbH
Current assignee: Siemens Mobility GmbH
Priority date: 2019-06-14
Filing date: 2020-05-25
Publication date: 2022-03-09
Anticipated expiration: 2040-05-25
Also published as: EP3963291B1; DE102019208669B3; WO2020249381A1; ES2963558T3

Abstract

The invention relates, inter alia, to a method for operating a sensor array (10) for monitoring a technical system, said sensor array having at least two sensors (S1, S2) and an evaluation device (AWE), wherein the evaluation device (AWE) can evaluate the sensor signals (Ms1, Ms2) of the at least two sensors (S1, S2). According to the invention, each of the sensors (S1, S2) is assigned a reliability value (Vw(S1), Vw(S2)) which represents the reliability of the sensor signal (Ms1, Ms2) of the relevant sensor (S1, S2), wherein the reliability value (Vw(S1), Vw(S2)) indicates whether the sensor (S1, S2) can be considered reliable and its sensor signal (Ms1, Ms2) is useable, the sensor (S1, S2) can be considered not reliable and its sensor signal (Ms1, Ms2) is not useable, or the sensor (S1, S2) can be considered reliable to a limited extent and its sensor signal (Ms1, Ms2) is useable to a limited extent, and the evaluation device (AWE) generates a status value (Z) which describes the status of the system solely on the basis of the reliable sensors (S1, S2) and those sensors (S1, S2) which are reliable to a limited extent and satisfy at least one predefined additional condition.

Description

description

Sensor arrangement for monitoring a technical system and method for operating a sensor arrangement

The invention relates to sensor assemblies and

Procedure for their operation.

In known sensor arrangements with redundantly operating sensors, sensor signals are only taken into account if the sensors are considered to be functional;

otherwise their sensor signals are not taken into account.

If the number of functioning sensors falls below a specified number, the sensor arrangement is deemed to be defective

viewed.

The invention is based on the object of specifying a method for operating sensor arrangements which is improved compared to previously known methods.

According to the invention, this object is achieved by a method having the features according to patent claim 1. Advantageous embodiments of the method according to the invention are specified in the subclaims.

According to the invention it is then provided that each of the

Sensors are each assigned an indication of trust that indicates the trustworthiness of the sensor signal of the respective sensor, the indication of trust indicating whether the sensor is to be regarded as trustworthy and its sensor signal can be used, the sensor as not trustworthy

view and whose sensor signal cannot be used or the sensor is to be viewed as trustworthy to a limited extent and whose sensor signal can be used to a limited extent, and the evaluation device provides a state information describing the state of the system exclusively on the basis of the

trustworthy sensors as well as those restricted trusted sensors that meet at least one predetermined additional condition generated.

An essential advantage of the method according to the invention can be seen in the fact that the evaluation device is more likely to correctly generate a status information describing the status of the system. The greater probability of the correctness of the status information is achieved in particular by restricting

Trusted or untrustworthy sensors are only used to a limited extent or are not used.

It is advantageous if the confidence information is re-determined and / or updated regularly or irregularly, in particular stochastically.

The confidence information is preferably new, at least also on the basis of the time profile of the sensor signals

determined and / or updated.

The

Confidence information is particularly preferably at least also based on the time profile of the sensor signals relative to the

Comparison to one another and / or taking into account the respective system state of the technical system (for example known from another source) when recording the time profile.

The at least one predefined additional condition or one of the predefined additional conditions becomes

preferably regarded as fulfilled if a predetermined control criterion is fulfilled before a one occurs

Sensor signal, the confidence information of the respective sensor, an increase in the confidence for a predetermined test period before the occurrence of this sensor signal, that is, the one indicating the fulfillment of the control criterion

Sensor signal. In the case of temperature sensors, the specified

The control criterion can be, for example, a limit temperature or a maximum temperature which the technical system should not or must not exceed.

It is also advantageous if the at least one predefined additional condition or one of the predefined additional conditions is considered to be met if after

Occurrence of a predetermined control criterion

If the sensor signal fulfills the confidence information of the respective sensor, it indicates an increase in the trustworthiness for a predetermined minimum period of time after the occurrence of this sensor signal, that is to say the sensor signal indicating the fulfillment of the control criterion.

Alternatively or additionally, it can advantageously be provided that the at least one predetermined

additional condition or one of the specified additional conditions is considered to be met if after

Occurrence of a predetermined control criterion

fulfilling sensor signal the confidence of the respective sensor increases and within a predetermined

Minimum time span reached a predetermined minimum confidence threshold.

The predefined minimum confidence threshold is preferably that threshold from which the sensor is viewed as trustworthy.

additional condition or one of the predefined additional conditions is considered to be fulfilled if, after the occurrence of a predefined control criterion, it is fulfilled

Sensor signal the sensor signal the control criterion

within a specified minimum period of time thereafter

continue or at least within the specified

Minimum time period repeatedly met. The predetermined minimum time period is preferably one

Danger time span of the technical system, within which, after a dangerous situation has been recognized, in particular after the specified control criterion has been met, a

Emergency action is to be carried out, or part of this period of danger.

The evaluation device preferably has a

Input interface at which a nominal measured value for one, several or all sensors of the sensor arrangement can be input.

It is advantageous if the evaluation device uses the setpoint measured value to provide the confidence information for the person or persons

respective sensors recalculated or updated.

As an alternative or in addition, the evaluation device can have an input interface at which a confidence level for one, several or all sensors of the sensor arrangement can be input. The evaluation device preferably assigns the entered confidence information to the respective sensors.

In addition, it is considered advantageous if the

Evaluation device is or has a learning computing device which determines the confidence information taking into account a fixed predetermined one

Plausibility strategy and / or taking into account a self-determined plausibility strategy

performs.

The technical system is preferably a vehicle brake system.

The at least two sensors are preferred

Temperature sensors that measure the temperature of the brake system or another part of a vehicle, in particular a

Wheel bearing, a wheel set that can be braked by the brake system or a wheel of the vehicle that can be braked by the brake system stores, measures and generates a temperature signal as a sensor signal.

The above-mentioned control criterion is preferably a temperature specification, in particular one that specifies a maximum permissible limit temperature for an axle bearing.

The invention also relates to a sensor arrangement with at least two sensors and an evaluation device for monitoring a technical system, the

Evaluation device, the sensor signals of the at least two

Can evaluate sensors. According to the invention, it is provided in this regard that the evaluation device is designed to assign each of the sensors a confidence specification which indicates the trustworthiness of the sensor signal of the sensor, the confidence specification indicating whether the sensor can be regarded as trustworthy and its sensor signal can be evaluated, the sensor as not trustworthy and whose sensor signal cannot be used or the sensor is regarded as trustworthy to a limited extent and its

Sensor signal can be used to a limited extent, and the

Evaluation device is also designed to provide a status specification describing the status of the system

exclusively on the basis of the trustworthy sensors and those sensors with limited trustworthiness that have at least one specified additional condition

meet, generate.

With regard to the advantages of the sensor arrangement according to the invention and with regard to advantageous refinements of the

Sensor arrangement according to the invention is based on the above

Comments related to the above

Referenced procedure.

The invention also relates to a vehicle that is equipped with such a sensor arrangement. The invention is explained below with reference to

Embodiments explained in more detail, show it

exemplary

Figure 1 shows an embodiment of an inventive

Sensor arrangement, on the basis of which exemplary embodiments for the method according to the invention are explained,

FIG. 2 shows the course of confidence values over time t,

FIG. 3 shows an example for a plausibility check of

Trustworthy and

FIG. 4 shows a rail vehicle in which the sensor arrangement according to FIG. 1 is used for hot runner detection.

In the figures are for identical or comparable

Components always use the same reference symbols.

FIG. 1 shows a sensor arrangement 10 which is suitable for monitoring a technical system which is not shown further. The evaluation device comprises two sensors S1 and S2 and one connected to the two sensors S1 and S2

Evaluation device AWE. The evaluation device AWE comprises a computing device 101 and a memory 102 in which, among other things, a software module SM that defines the mode of operation of the evaluation device AWE is stored.

The evaluation device AWE is designed to assign a confidence specification in the form of a confidence value to each of the sensors S1 and S2. In FIG. 1, the trust value for the sensor S1 is with the reference symbol Vw (Sl) and the trust value for the sensor S2 with the

Reference symbol Vw (S2) denotes. The confidence values Vw (Sl) and Vw (S2) are preferably stored in memory 102.

The confidence values Vw (Sl) and Vw (S2) give the

Trustworthiness of the sensor signals Msl and Ms2 of the

Sensors S1 and S2 on. The trust values Vw (Sl) and Vw (S2) each indicate specifically whether and to what extent the sensor S1 or S2 is to be regarded as trustworthy and its sensor signal Msl or Ms2 can be used. The

Evaluation device AWE generates a state of the technical system that is not shown

State indication Z exclusively on the basis of such

Sensors that are fully trustworthy or at least have limited trustworthiness, provided

the latter meet at least one predetermined additional condition.

The evaluation device AWE can have an input interface ESS at which a setpoint measured value for the sensors S1 and S2 and / or confidence specifications Vw (Sl) and Vw (S2) for the sensors S1 and S2 can be entered.

In the following, examples will be used to explain how the arrangement according to FIG. 1 can work or be configured; the following explanations are only to be understood as examples and can be combined or modified in many ways:

In the sensor arrangement 10 according to FIG. 1, it is possible to expand the plausibility check of the sensors S1, S2 to include a check for plausible behavior and to take a historical component into account. In this way, each sensor channel formed by a sensor, hereinafter also referred to as channel for short, of a monitoring system can be assigned a trust value that describes with a continuous or discrete scale between "defective" and "very likely fully functional" Probability this channel a truthful one

Provides measured value.

The longer a sensor shows plausible or implausible behavior, the more this trust value shifts in the corresponding direction. With an obvious one

Sensor errors can also result in a sudden and permanent setting to "defective" and permanent removal from the group.

On the basis of this trustworthiness, a decision is made as to whether the respective sensor is taken into account in the evaluation or not. With a suitable design, a decision basis that can be relied on to be safe is also available, on the basis of which it can be decided in the case of a single-channel alarm whether a real alarm or a false alarm

is to go out. It is also conceivable that a single-channel alarm could be triggered by an untrustworthy channel for a

defined time is ignored. A suitable design also enables this extended plausibility check to be carried out without informing the other channel, so that the requirement for independence is met.

A possible implementation of the technical solution should

in more detail below using a specific example

be made clear:

After installation, two sensors S1 and S2 according to FIG. 1 initially receive the trust value 100 (corresponds to: “very

probably fully functional "). During operation, both sensors initially show a plausible behavior that also corresponds to the expected (change) behavior. This means that the trust value can rise to a maximum of 120. If a sensor temporarily shows implausible behavior and may even be temporarily out of group, so be sinks

Trustworthy.

FIG. 2 shows, by way of example, the course over time of the confidence values Vw (S1) and Vw (S2) over time t. In the in In the example shown in FIG. 2, different events lead to different deductions of the trust points. If a sensor shows plausible behavior again, the trust points increase accordingly.

Single-channel status reports (alarms) from sensors over 80 trust points are preferably considered valid, since the sensor is "very likely" (100-120

Trust points) or "probably" (80 - 99

Trust points) is "fully functional". If a sensor has 40 to 79 trust points, it is preferably viewed as "subject to functional condition".

Single-channel messages from sensors are only considered valid if the second channel has more than 80 trust points and reports deviating measured values, preferably only if the message is repeated or permanent. The channels with their respective trust points are preferably brought together in a higher-level entity. Sensors with less than 40 trust points are preferably marked as defective.

A suitable design of this approach presupposes that suitable criteria can be found for the observed monitoring function, from which a plausible one can be found

Behavior of the respective sensor can be closed.

For this purpose, the relevant operational influencing variables on the measured variable of the monitoring system must be identified.

The following is an example of hot-runner monitoring in rail vehicles, in which the condition of the wheelset bearings is monitored by means of temperature measurement. The temperature of the wheelset bearings essentially results from the dissipation inside the bearing and the boundary conditions that define the heat transfer to the environment. For the former, the driving speed and the wear and maintenance condition of the bearing should be mentioned. External boundary conditions include the air flow around them

(Driving speed), the ambient temperature and the Exposure to sunlight. This particularly offers the

Check whether the temperature reading of a bearing is consistent with the ambient temperature and the

Driving speed changes. A comparison with the temperature profile of other bearings in the vehicle can also be considered. It should be noted that not all bearings have one

Rail vehicle or train a similar temperature

show: Deviations within the rail vehicle or train can e.g. B. by a different greasing or bearing preload in tapered roller bearings. Therefore, this comparative plausibility check should not be based on the absolute values, but consider rates of change that result in a similar way from the common operational parameters (speed, ambient temperature). In particular, it should be noted that the

Failure behavior of a warehouse is not considered implausible

Behavior is valued.

The cooling behavior at standstill is particularly useful for a positive plausibility check. The friction line entry is obviously zero, so that a sensible cooling of the bearing can be checked. The external parameters such as B. the ambient temperature can possibly be determined via a common train-wide evaluation of all sensors of a channel.

FIG. 3 shows an example of a plausibility check at a standstill. Curve 301 in FIG. 3 shows a plausible temperature profile T of a wheelset bearing at a standstill following normal operational use over time t: According to the heat dissipation to the environment, there is essentially an exponential temperature decrease starting from an initial temperature T0. It can be taken into account here that the time constant of the exponential decrease can change with a change in the ambient conditions. The trust value of a sensor that has an almost exponential temperature profile when it is at a standstill can be increased. For comparison, curve 302 in FIG. 3 shows the measurement signal of a defective sensor, the measurement signal profile of which bears no resemblance in any way to an exponential decrease: the confidence value of this sensor is accordingly preferably reduced.

A possible extension or variant of the above

The procedure described consists of the manual entry of a trust value. Among other things at the

Hot runner monitoring is the manual checking of the

Wheelset bearing temperature possible in the event of an alarm, after which the hot box monitoring is switched off if necessary. There is now the possibility that the operating or

Maintenance staff enter a new trust value for one or more channels after manual testing

Monitoring system.

Another extension or variant of the method described above is the possibility of manually controlling the monitoring system by means of an input mask with manual, system-independent monitoring of the system status

supply. For example, the manual input of a wheelset bearing temperature from the monitoring system to the

Update of the trustworthiness of both channels can be used.

Changes to the trust values can be made, for example, as part of maintenance.

In addition to defining and parameterizing these criteria when designing the monitoring system, self-learning systems can also come into question. A distinction can be made between two variants: One possibility is, for example, to specify the structure of the plausibility criteria; the self-learning system is simply left with the determination of the suitable parameters. Another variant includes the determination of the structure in the self-learning system. In both cases, the relevant operational parameters that influence the Measured value identified and taken into account in the design of the self-learning system. An extension of this

self-learning approach can include the central evaluation of information from an entire fleet. The knowledge gained in this way preferably flows back into the monitoring systems of the individual vehicles via automatic data transmission.

In the first step, based on a

cross-fleet (comparative) analysis

Land-based systems, the trust values in a specific vehicle or a specific sensor can be changed.

Figure 4 shows an embodiment for a

Rail vehicle 20, which is equipped with a sensor arrangement,

for example the sensor arrangement 10 according to FIG. 1,

Is provided. The sensor arrangement 10 is used to monitor a technical system of the rail vehicle 20,

for example a brake system 21.

The two sensors S1 and S2 can, for example, be temperature sensors that measure the temperature of the

Measure brake system 21, in particular a wheel bearing 22, and generate temperature signals as sensor signals.

Although the invention is detailed by preferred

Exemplary embodiments have been illustrated and described in more detail, the invention is not restricted by the disclosed examples and other variations can be derived therefrom by the person skilled in the art, without the scope of protection

Invention to leave. List of reference symbols

10 Sensor arrangement

20 rail vehicle

21 Brake system

22 wheel bearings

101 computing device

102 memory

301 curve

302 curve

AWE evaluation device

ESS input interface

Msl sensor signal

Ms2 sensor signal

51 sensor

52 sensor

SM software module t time

T temperature profile

T0 starting temperature

Vw (Sl) Trustworthy

Vw (S2) Trustworthy

Z status information

Claims

1. A method for operating at least two sensors (Sl, S2) and an evaluation device (AWE) having

Sensor arrangement (10) for monitoring a technical

System, wherein the evaluation device (AWE) can evaluate the sensor signals (Msl, Ms2) of the at least two sensors (Sl, S2),

d a d u r c h e k e n n n z e i c h n e t that

- Each of the sensors (Sl, S2) is assigned a confidence specification (Vw (Sl), Vw (S2)) which the

The trustworthiness of the sensor signal (Msl, Ms2) of the respective sensor (Sl, S2) indicates, with the

Confidence (Vw (Sl), Vw (S2)) indicates whether the sensor (Sl, S2) is to be regarded as trustworthy and its

Sensor signal (Msl, Ms2) can be used, the sensor (Sl,

S2) as untrustworthy and its

Sensor signal (Msl, Ms2) cannot be used or the

Sensor (S1, S2) as trustworthy to a limited extent

and whose sensor signal (Msl, Ms2) can be used to a limited extent, and

- The evaluation device (AWE) generates a status information (Z) describing the status of the system exclusively on the basis of the trustworthy sensors (S1, S2) and those sensors (S1, S2) with limited trust that meet at least one predetermined additional condition.

2. The method according to claim 1,

d a d u r c h e k e n n n z e i c h n e t that

the confidence information (Vw (Sl), Vw (S2)) are regularly or irregularly, in particular stochastically, newly determined and / or updated.

3. The method according to any one of the preceding claims,

d a d u r c h e k e n n n z e i c h n e t that

the confidence information (Vw (Sl), Vw (S2)) at least also on the basis of the time course of the sensor signals (Msl, Ms2), in particular, can be newly determined and / or updated relative to one another and / or taking into account the respective system status of the system when recording the time profile.

4. The method according to any one of the preceding claims,

d a d u r c h e k e n n n z e i c h n e t that

the at least one predefined additional condition or one of the predefined additional conditions is considered to be fulfilled if, before a sensor signal (Msl, Ms2) fulfills a predefined control criterion, the confidence level (Vw (Sl), Vw (S2)) of the respective sensor (Sl , S2) an increase in trustworthiness for one

specified test period before this occurs

Sensor signal (Msl, Ms2), i.e. the fulfillment of the

Control criterion indicating sensor signal (Msl, Ms2), indicates.

5. The method according to any one of the preceding claims,

d a d u r c h e k e n n n z e i c h n e t that

the at least one predefined additional condition or one of the predefined additional conditions is regarded as fulfilled if, after the occurrence of a

sensor signal (Msl, Ms2) fulfilling the specified control criterion, the confidence level (Vw (Sl), Vw (S2)) of the

respective sensors (Sl, S2) an increase in the

Indicates trustworthiness for a predetermined minimum period of time after the occurrence of this sensor signal (Msl, Ms2), that is to say of the sensor signal (Msl, Ms2) indicating the fulfillment of the control criterion.

6. The method according to any one of the preceding claims,

d a d u r c h e k e n n n z e i c h n e t that

sensor signal (Msl, Ms2) fulfilling the specified control criterion, the confidence level (Vw (Sl), Vw (S2)) of the respective sensor (S1, S2) increases and within a predetermined minimum period of time a predetermined

Minimum confidence threshold reached.

7. The method according to claim 6,

d a d u r c h e k e n n n z e i c h n e t that

the predetermined minimum confidence threshold is that threshold from which the sensor (S1, S2) is considered trustworthy

is seen.

8. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

the at least one predefined additional condition or one of the predefined additional conditions is considered to be fulfilled if, after a sensor signal (Msl, Ms2) that fulfills a predefined control criterion, the sensor signal meets the control criterion within a

specified minimum period of time thereafter or

met repeatedly at least within the specified minimum period of time.

9. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

the specified minimum time span is a danger time span of the technical system, within which after detection of a dangerous situation, in particular after fulfillment of the

specified control criterion, an emergency action is to be taken, or the specified minimum period of time

Part of this risk period is.

10. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

- the evaluation device (AWE) an input interface

(ESS), at which a nominal measured value for one, several or all sensors (S1, S2) of the sensor arrangement (10) can be entered, and

- The evaluation device (AWE) based on the target measured value, the confidence information (Vw (Sl), Vw (S2)) for the or the respective sensors (Sl, S2) recalculated or updated.

11. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

- the evaluation device (AWE) an input interface

(ESS), on which a confidence statement (Vw (Sl), Vw (S2)) for one, several or all sensors (Sl, S2) of the sensor arrangement (10) can be entered, and

- The evaluation device (AWE) assigns the entered confidence information (Vw (Sl), Vw (S2)) to the respective sensors (Sl, S2).

12. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

the evaluation device (AWE) is or has a learning computing device (101) which determines the

Confidence information (Vw (Sl), Vw (S2)) taking into account a firmly specified plausibility strategy and / or taking into account a self-determined one

Carries out a plausibility check strategy.

13. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that

- the technical system a braking system (21) one

Vehicle is and / or

- The at least two sensors (S1, S2) are temperature sensors that measure the temperature of the brake system (21) or another part of the vehicle, in particular an axle or wheel bearing (22), one of the brake system (21)

brakable wheelset or a wheel of the vehicle which can be braked by the brake system (21) stores, measures and as

Sensor signal (Msl, Ms2) generates a temperature signal, and / or

- the control criterion is a temperature specification and / or

- The control criterion is a temperature specification that is the maximum allowed for an axle or wheel bearing (22)

Limit temperature.

14. Sensor arrangement (10) with at least two sensors (Sl, S2) and an evaluation device (AWE) for monitoring a technical system, the evaluation device (AWE) evaluating the sensor signals (Msl, Ms2) of the at least two sensors (Sl, S2) can,

d a d u r c h e k e n n n z e i c h n e t that

- The evaluation device (AWE) is designed to provide each of the sensors (S1, S2) with a statement of confidence

(Vw (Sl), Vw (S2)) to be assigned, which indicates the trustworthiness of the sensor signal (Msl, Ms2) of the sensor (Sl, S2), the confidence indication (Vw (Sl), Vw (S2)) indicating whether the Sensor (Sl, S2) to be seen as trustworthy and whose sensor signal (Msl, Ms2) is usable, the sensor (Sl, S2) is to be seen as untrustworthy and whose sensor signal (Msl, Ms2) is not usable or the

Sensor (S1, S2) as trustworthy to a limited extent

and whose sensor signal (Msl, Ms2) can be used to a limited extent, and

- The evaluation device (AWE) is also designed for this purpose

is, one that describes the state of the system

Status information (Z) exclusively on the basis of the trustworthy sensors (S1, S2) and those sensors (S1, S2) that are trustworthy to a limited extent and which have at least one predetermined additional condition

meet, generate.

15. Vehicle, in particular rail vehicle (20),

d a d u r c h e k e n n n z e i c h n e t that

the vehicle is equipped with a sensor arrangement (10) according to claim 14 and the sensor arrangement (10) is a technical system of the vehicle, in particular a brake system (21) of the vehicle.